Privacy Policy

1. Information we collect

We collect personal data directly from you, automatically through your use of the Website and Platform, through recording devices in the Programme, and from third parties, as permitted by law.

1.1. Customers, platform users and business contacts

1. (a) Identity and contact data: name, job title, employer, business email address, telephone number and postal address.
2. (b) Account data: login credentials and account settings for the Platform.
3. (c) Commercial and billing data: licences purchased, orders, invoices, payment details processed by our payment providers, and contract records.
4. (d) Communications data: emails, meeting notes, support requests and other correspondence with us.

1.2. Participants in the Programme

1. (a) Participation records: your name (stored encrypted), employer, site, signed consent agreement, the encrypted identifier linking you to your recording sessions, session dates and times, and any withdrawal of consent.
2. (b) Recordings: first-person video, image frames, audio, motion and inertial (IMU) data, head position, timestamps, environmental sensor data, device telemetry and associated metadata captured while you perform your work in agreed recording areas and time windows.
3. (c) Biometric data: information in or derived from Recordings that may be capable of identifying you, including facial geometry and landmarks, body pose, skeletal keypoints, hand keypoints, gait characteristics and movement patterns. We do not process this data to identify or authenticate you.
4. (d) Other people: Recordings may inadvertently capture other people at the site. We permanently anonymise them and do not otherwise use data about them (see Section 4).

1.3. Information collected automatically

When you access the Website or Platform, we automatically collect technical and usage information, including your IP address, device and browser type, operating system, pages viewed, features used, time spent, crash logs, and approximate location derived from your IP address. When you use the Rig Live app, we collect your sign-in email address or Google account, your device details, the serial number of the rig you connect to, and the status of your recordings. This information is collected via cookies and similar technologies on the Website and azimov.vfrog.ai. We use it to maintain and improve performance, ensure security, detect and prevent fraud, and analyse usage trends. For more information, please refer to Section 9.

1.4. Information you choose to provide

You may voluntarily provide information such as business requirements, feedback, survey responses or other notes when contacting us by email, phone, through the Website or by other channels. This includes communications records for support and complaints.

1.5. Information from third parties

1. (a) Employers and site partners: the names and roles of employees who have agreed to take part in the Programme, and site schedules.
2. (b) Data marketplaces and brokers: business contact details of prospective licensees who request our Datasets through them.
3. (c) Business data providers: professional contact details (such as name, job title, company and business email) from commercial databases and public professional sources, which we use to contact businesses that may be interested in our services or in supplying data.
4. (d) Service providers: sign-in, payment and identity verification providers.

2. How we use information

We process personal data only where a lawful basis applies. The purposes and corresponding legal bases are described below.

1. (a) Provide and manage the services (Contractual necessity / Legitimate interests): we use identity, contact, account and billing data to create and administer accounts, provide access to the Platform and to Datasets, process payments and perform our contracts.
2. (b) Communications (Contractual necessity / Legitimate interests): we use contact details to send order confirmations, licence documents, invoices, service changes, and other transactional or support messages.
3. (c) Account management (Contractual necessity / Legitimate interests): we use your data to provide account access, enforce our terms of use, and notify you about changes.
4. (d) Customer support (Legitimate interests): we use identity, contact and communications data to troubleshoot issues, respond to enquiries and resolve complaints.
5. (e) Platform monitoring and integrity (Legitimate interests): we process usage data to maintain the integrity of the Platform, detect misuse, ensure compliance with applicable law, and protect the rights and interests of vfrog and its users.
6. (f) Marketing and business development (Consent / Legitimate interests): with your consent where required by law, we send promotional updates and surveys. We also contact businesses using professional contact data to offer our services or invite them to supply data. You can opt out at any time (Section 10).
7. (g) Analytics and improvement (Legitimate interests): we analyse usage data to understand how the Website and Platform are used, evaluate performance, develop new features and improve our services.
8. (h) Security and fraud prevention (Legal obligations / Legitimate interests): we process data to detect and prevent fraud, enforce our agreements and comply with legal obligations.
9. (i) Programme administration (Consent / Contractual necessity): we use participation records to schedule and manage recording sessions, link sessions to the consent that covers them, and give effect to withdrawals of consent.
10. (j) Creating and licensing Datasets (Explicit consent): we process Recordings, including biometric data, to anonymise them, annotate tasks and actions (using automated tools, including vision-language models and in-house hand tracking, and human labellers), check quality, and compile anonymised Datasets that we license worldwide for the development, training, testing and evaluation of robotics, computer vision and artificial intelligence systems.
11. (k) Provenance and compliance records (Legal obligations / Legitimate interests): we keep records of where, when and under which agreements each Recording was made, and of its processing, anonymisation, storage, transfer and delivery history, for audit, regulatory compliance, chain of custody and due diligence by licensees.
12. (l) Aggregated statistics (Legitimate interests): we may anonymise personal data to create aggregated statistics that do not identify you, and use them to analyse trends, plan product improvements and prepare reports.

What we do not do. We do not use Recordings or Datasets to monitor, evaluate, discipline or make any decision about an individual Participant, or to identify or authenticate any individual. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

3. When we process information (legal bases)

Depending on the law that applies to you, we rely on:

1. (a) Contractual necessity: to fulfil our contract with you or take steps at your request before entering into one.
2. (b) Consent: for optional uses (such as marketing and non-essential cookies) and for Participants’ participation in the Programme. You can withdraw consent at any time.
3. (c) Explicit consent: for biometric and other sensitive personal data in Recordings (including under Article 9(2)(a) GDPR and the equivalent provisions of the UAE PDPL, the Saudi PDPL, the Qatar PDPPL, and the consent requirements for sensitive data under the Delaware DPDPA).
4. (d) Legal obligations: to comply with applicable law, for example tax, accounting and record-keeping requirements.
5. (e) Legitimate interests: for purposes such as service improvement, Platform integrity, security, business development, provenance records and defending legal claims. We balance these interests against your rights and freedoms.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Anonymised Datasets

4.1. Anonymisation before delivery

Before any Dataset is licensed or delivered, in any format (including raw video files with their metadata), we apply privacy-preserving processing designed to remove or irreversibly obscure identifiable personal information, including faces, vehicle registration plates, personal documents, addresses, names appearing in view, brand names, logos and signage, and other third-party intellectual property, except where retention is expressly permitted by law or based on a valid legal basis. Anyone captured incidentally, including bystanders and minors, is permanently anonymised.

4.2. Audio

The recording devices capture audio as part of their normal operation. We discard audio before the Recordings are uploaded to cloud storage. We do not use audio, and it does not form part of any Dataset.

4.3. Our commitment on de-identified data

We maintain and use Datasets only in anonymised or de-identified form. We do not attempt to re-identify any individual from a Dataset, except to test whether our anonymisation processes are effective, and we contractually prohibit licensees and other recipients from re-identifying or attempting to re-identify any individual. Datasets are designed not to identify individuals, and we license them only on these terms.

5. How we disclose information

We may share personal data with the following categories of recipients:

1. (a) Service providers: companies that perform functions on our behalf under contract and confidentiality obligations, including cloud hosting and storage (including Google Cloud and Microsoft Azure), compute providers that run anonymisation, data labelling providers, communications and email delivery, customer relationship management, business data and enrichment, payment processing, analytics, security and compliance monitoring, and IT support.
2. (b) Employers and site partners: for Participants, we share with your employer only what is needed to run the Programme, such as your participation status and session schedule.
3. (c) Licensees, data marketplaces and brokers: we license only anonymised Datasets, directly or through data marketplaces and brokers. We share business contact details with marketplaces and brokers where needed to complete a transaction.
4. (d) Group companies: entities within our corporate group, including vfrog Technology Middle East Ltd (Dubai International Financial Centre) and any regional affiliates we establish, for internal administration, support and regional operations.
5. (e) Authorities: public authorities, law enforcement agencies or regulators where required by law or in connection with legal claims.
6. (f) Professional advisers: lawyers, auditors and other advisers under duties of confidentiality.
7. (g) Business transfers: in the event of a merger, acquisition, financing or sale of assets, personal data may be transferred subject to applicable laws.

We do not sell personal information for monetary or other valuable consideration, and we do not share personal information for cross-context behavioural advertising or targeted advertising. We have not done so in the preceding 12 months.

6. Data retention

6.1. General

We retain personal data only for as long as necessary to fulfil the purposes described above or to comply with legal obligations. Generally, this means:

1. (a) Active accounts and relationships: we keep your data while your account or business relationship remains active.
2. (b) After termination: we retain contract, billing and communications records for seven (7) years after the relationship ends to comply with legal obligations (such as tax and accounting) and to defend legal claims.
3. (c) Business contact data used for outreach: twenty-four (24) months after our last interaction, or until you opt out, after which we keep a suppression record so we do not contact you again.
4. (d) Legal requirements: we may retain certain data longer if required by law, or to address legal proceedings, fraud or security incidents.
5. (e) Anonymised data: we may retain anonymised Datasets and aggregated data indefinitely, because they do not identify individuals.
6. (f) Consent-based data: we retain data processed on the basis of consent until you withdraw consent or it is no longer necessary for its purpose. After withdrawal, we keep a minimal record of your consent and its withdrawal to demonstrate compliance.

6.2. Recordings and biometric data: retention and destruction schedule

1. (a) Raw Recordings and biometric identifiers capable of identifying a Participant are retained only as long as reasonably necessary for processing, quality assurance, anonymisation and Dataset preparation, and in any event no longer than six (6) months after the Recording is made, unless a longer period is required by law or necessary for the establishment, exercise or defence of legal claims.
2. (b) When that period ends, or earlier when a Participant withdraws consent (Section 7.3), the data is permanently deleted or irreversibly anonymised.
3. (c) Audio is discarded before the Recordings are uploaded to cloud storage and is not retained.
4. (d) Signed consent agreements and provenance records are retained for as long as any Dataset derived from the relevant Recordings is licensed, plus seven (7) years, so that we can demonstrate the lawful origin of the data.

7. Your privacy rights

7.1. Your rights

Depending on where you live, you may have the right to:

1. (a) access personal data we hold about you and receive information about how it is processed;
2. (b) rectify inaccurate or incomplete data;
3. (c) erase personal data in certain cases, subject to legal exemptions;
4. (d) restrict or stop processing in specific circumstances;
5. (e) receive your data in a structured, commonly used, machine-readable format (data portability);
6. (f) object to processing based on legitimate interests, and to direct marketing at any time;
7. (g) object to automated processing and request human intervention;
8. (h) withdraw consent at any time, where processing is based on consent; and
9. (i) lodge a complaint with a data protection authority.

7.2. How to exercise your rights

To exercise any of these rights, contact sec@vfrog.ai. We may ask you to verify your identity, and we verify requests by matching the information you give us with information we already hold. You may use an authorised agent where the law allows; we may ask the agent for proof of authorisation and ask you to verify your identity directly. We aim to respond within one month of receiving a verified request. Where the applicable law allows a longer period, we may extend it as that law permits (for example, by up to two further months under the GDPR, or by up to 45 further days under the CCPA and the Delaware DPDPA), and we will tell you of the extension and the reasons for it. We will not discriminate against you for exercising your rights.

If you have concerns about how we process your personal data, you may contact us at any time at sec@vfrog.ai. We aim to respond to complaints within one month.

7.3. Participants: withdrawing consent

Participation in the Programme is voluntary. You may withdraw your consent at any time, for any reason and without penalty, by emailing sec@vfrog.ai or through the Rig Live app. You may also inform your employer, who will pass your request to us. When we receive your withdrawal, we stop recording you, use the encrypted identifier linked to your sessions to identify all of your Recordings, and remove them from our collection within one month. We stop using your Recordings straight away, and wait seven days before deleting them so that a withdrawal made by mistake can be cancelled. Your Recordings are excluded from all future Datasets. Withdrawal applies to future processing. It does not affect processing already lawfully carried out, or anonymised Datasets licensed before the withdrawal, which are designed not to identify you. Your rights in Section 7.1 apply to your participation records and any Recordings we still hold.

7.4. California residents (CCPA)

If you are a California resident, the CCPA gives you the right to know what personal information we collect, use and disclose; to request deletion; to request correction; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to receive discriminatory treatment for exercising these rights. We confirm receipt of requests to know, delete or correct within 10 business days and respond within 45 days, extendable by a further 45 days where reasonably necessary.

In the preceding 12 months we have collected the following categories of personal information, from the sources described in Section 1, for the purposes described in Section 2, and disclosed them for a business purpose to the recipients described in Section 5. We retain each category for the periods in Section 6.

We do not sell or share personal information, including sensitive personal information, and have no actual knowledge of selling or sharing personal information of consumers under 16. We use sensitive personal information only to provide the services and for other purposes permitted under the CCPA regulations, and not to infer characteristics about you, so the right to limit does not apply. We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing.

7.5. Delaware and other US state residents

If you are a resident of Delaware or another US state with a comprehensive privacy law, you may have the right to confirm whether we process your personal data and to access it; to correct inaccuracies; to delete it; to obtain a portable copy; to obtain a list of the categories of third parties to which we have disclosed your personal data; and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in any of these three activities. We process sensitive data only with your consent. We respond within 45 days, extendable once by 45 days where reasonably necessary.

If we decline to act on your request, you may appeal by emailing sec@vfrog.ai with “Privacy appeal” in the subject line. We will respond to your appeal within 60 days, explaining our decision. If your appeal is denied, you may contact the Delaware Department of Justice, or the attorney general of your state.

7.6. European Economic Area and United Kingdom (GDPR)

If you are in the European Economic Area or the United Kingdom, vfrog, Inc. is the controller of your personal data. You have the rights in Section 7.1, and the legal bases we rely on are set out in Sections 2 and 3. You may lodge a complaint with the supervisory authority in the country where you live or work or where an alleged infringement occurred, or, in the United Kingdom, with the Information Commissioner’s Office. Transfers of your data outside the EEA or UK are described in Section 12.

7.7. Gulf Cooperation Council

1. (a) United Arab Emirates: under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”), you have the rights in Section 7.1 and may lodge a complaint with the UAE Data Office. The UAE PDPL does not apply to companies and establishments in free zones that have their own data protection laws, such as the Dubai International Financial Centre and Abu Dhabi Global Market.
2. (b) Dubai International Financial Centre: where vfrog Technology Middle East Ltd is the controller, the DIFC Data Protection Law (DIFC Law No. 5 of 2020) applies. You have the rights in Section 7.1 and may lodge a complaint with the DIFC Commissioner of Data Protection.
3. (c) Kingdom of Saudi Arabia: under the Personal Data Protection Law, you have the right to be informed of how your personal data is processed, to access and obtain a copy of it, to request its correction, completion or update, and to request its destruction when no longer needed, and to withdraw consent. You may lodge a complaint with the competent authority under that law.
4. (d) State of Qatar: under Law No. 13 of 2016 on the Protection of Personal Data Privacy (the “PDPPL”), you have the right to withdraw consent, in certain cases to object to processing or request erasure, to request correction, to be notified of processing and of any inaccurate disclosure, and to access your personal data. You may lodge a complaint with the competent department of the National Cyber Security Agency.
5. (e) Other GCC states: if you are in the Kingdom of Bahrain, the Sultanate of Oman or the State of Kuwait, you have the rights given by the data protection law of that state, which you can exercise as described in Section 7.2.

8. Security and incident response

We implement appropriate organisational and technical safeguards, including encryption of data at rest and in transit, role-based access controls, secure storage, staff confidentiality obligations and monitoring, to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or access. If a personal data breach occurs, we will notify you and the relevant authorities where legally required, within the time limits set by the applicable law.

9. Cookies and similar technologies

The Website and Platform use cookies and similar technologies for functionality, analytics and security. We use PostHog, an analytics service, which sets cookies to help us understand how the Website and Platform are used. You can block or delete cookies at any time through your browser settings.

Do Not Track. Some browsers send a “Do Not Track” signal. Because there is no common standard for these signals, we do not respond to them, but we honour Global Privacy Control signals as described in Section 7.4. We do not allow third parties to collect personal information about your online activities across different websites over time through the Website.

10. Communications

Transactional communications (such as service confirmations, licence documents, invoices and support notifications) are necessary to perform our contract with you and cannot be opted out of. We send promotional communications (such as newsletters, surveys and business development emails) only with your consent where required. You may opt out or withdraw consent at any time through the unsubscribe link in our communications or by contacting sec@vfrog.ai.

11. Third-party sites

The Website and Platform may contain links to external websites, including data marketplaces, with their own privacy practices. We are not responsible for these practices and encourage you to review their policies directly.

12. Cross-border data transfers

We operate internationally, and your personal data may be processed in countries other than the one where you live, including the United States, where data protection laws may differ.

1. (a) Recordings: raw Recordings are uploaded to cloud storage located in the country or region where they were collected. Anonymisation may run on computing resources in other countries, using temporary files only, with no storage there. Anonymised Datasets are stored in our cloud environment in the United States, from which licensees retrieve them. Our data labelling providers, including in Bangladesh, may view Recordings remotely to annotate them.
2. (b) Other personal data: customer, business contact and Website data is processed in the United States and in the countries where our group companies and service providers operate.
3. (c) Safeguards: we transfer personal data only as permitted by the applicable law, using the mechanisms it recognises, such as Standard Contractual Clauses approved by the European Commission (and the UK equivalent) for transfers from the EEA and UK, the transfer conditions of the UAE PDPL, the Saudi PDPL and the Qatar PDPPL, or your consent where the law requires it. We require every recipient to protect the data to a standard at least equivalent to this Policy. You may request a copy of the relevant safeguards by contacting us.

13. Children

The Website and Platform are intended for business use and are not directed at anyone under 18. Only adults take part in the Programme as Participants. We do not knowingly collect personal data from children. If a minor is captured incidentally in a Recording, they are permanently anonymised as described in Section 4. If you believe we hold personal data of a child, please contact us so that we can delete it.

14. Changes to this Policy

We may update this Policy to reflect legal, technical or business changes. We will indicate the effective date at the end of this Policy and provide notice where legally required. Where a change materially affects how we process Participants’ Recordings, we will inform Participants and obtain any new consent the law requires. Continued use of the Website or Platform after we notify you of changes means you accept the revised Policy, except where the law requires your consent.

15. Contact us

Questions, requests or complaints regarding this Policy can be directed to:

Last updated: 23 October 2026